diff options
author | John Terpstra <jht@samba.org> | 2003-04-08 04:42:44 +0000 |
---|---|---|
committer | John Terpstra <jht@samba.org> | 2003-04-08 04:42:44 +0000 |
commit | b15255d7ab8a0b883f97fe57bf7280fbbf8e92b7 (patch) | |
tree | fc61ab3537d56acf469c2faca0d0a8f47af7221d /source3 | |
parent | 8490fa485467edd9f03074a39329c3669663b2cf (diff) | |
download | samba-b15255d7ab8a0b883f97fe57bf7280fbbf8e92b7.tar.gz samba-b15255d7ab8a0b883f97fe57bf7280fbbf8e92b7.tar.xz samba-b15255d7ab8a0b883f97fe57bf7280fbbf8e92b7.zip |
Patch from Steve Langasek <vorlon@netexpress.net>
fix up two issues in
pam_smbpass. The first, more important issue is adding support for the
(apparently new) LOCAL_SET_PASSWORD flag to local_password_change(),
without which pam_smbpass is a complete and utter no-op. The second,
lesser issue is that with the advent of ldapsam, it's possible for
pam_smbpass to generate a SIGPIPE that isn't handled by the calling
application. The most basic signal wrapping is put in place to prevent
this.
Beyond that, the only thing in the patch is a bit of reformatting to
make pam_smb_passwd.c look a bit more like the rest of the code in CVS.
More of that later, I'm sure.
(This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
Diffstat (limited to 'source3')
-rw-r--r-- | source3/pam_smbpass/pam_smb_acct.c | 12 | ||||
-rw-r--r-- | source3/pam_smbpass/pam_smb_auth.c | 7 | ||||
-rw-r--r-- | source3/pam_smbpass/pam_smb_passwd.c | 124 |
3 files changed, 85 insertions, 58 deletions
diff --git a/source3/pam_smbpass/pam_smb_acct.c b/source3/pam_smbpass/pam_smb_acct.c index 0803ef82a2..2ea7eea7d8 100644 --- a/source3/pam_smbpass/pam_smb_acct.c +++ b/source3/pam_smbpass/pam_smb_acct.c @@ -47,7 +47,7 @@ int pam_sm_acct_mgmt( pam_handle_t *pamh, int flags, const char *name; SAM_ACCOUNT *sampass = NULL; - + void (*oldsig_handler)(int); extern BOOL in_client; /* Samba initialization. */ @@ -69,8 +69,12 @@ int pam_sm_acct_mgmt( pam_handle_t *pamh, int flags, _log_err( LOG_DEBUG, "acct: username [%s] obtained", name ); } + /* Getting into places that might use LDAP -- protect the app + from a SIGPIPE it's not expecting */ + oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN); if (!initialize_password_db(True)) { _log_err( LOG_ALERT, "Cannot access samba password database" ); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_AUTHINFO_UNAVAIL; } @@ -78,8 +82,10 @@ int pam_sm_acct_mgmt( pam_handle_t *pamh, int flags, pdb_init_sam(&sampass); pdb_getsampwnam(sampass, name ); - if (!sampass) + if (!sampass) { + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_USER_UNKNOWN; + } if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) { if (on( SMB_DEBUG, ctrl )) { @@ -90,11 +96,13 @@ int pam_sm_acct_mgmt( pam_handle_t *pamh, int flags, , "Your account has been disabled; " "please see your system administrator." ); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_ACCT_EXPIRED; } /* TODO: support for expired passwords. */ + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_SUCCESS; } diff --git a/source3/pam_smbpass/pam_smb_auth.c b/source3/pam_smbpass/pam_smb_auth.c index e5cc12e2f6..f4cbb59af3 100644 --- a/source3/pam_smbpass/pam_smb_auth.c +++ b/source3/pam_smbpass/pam_smb_auth.c @@ -36,6 +36,8 @@ #define AUTH_RETURN \ do { \ + /* Restore application signal handler */ \ + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); \ if(ret_data) { \ *ret_data = retval; \ pam_set_data( pamh, "smb_setcred_return" \ @@ -65,6 +67,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, SAM_ACCOUNT *sampass = NULL; extern BOOL in_client; const char *name; + void (*oldsig_handler)(int); BOOL found; /* Points to memory managed by the PAM library. Do not free. */ @@ -93,6 +96,10 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, _log_err( LOG_DEBUG, "username [%s] obtained", name ); } + /* Getting into places that might use LDAP -- protect the app + from a SIGPIPE it's not expecting */ + oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN); + if (!initialize_password_db(True)) { _log_err( LOG_ALERT, "Cannot access samba password database" ); retval = PAM_AUTHINFO_UNAVAIL; diff --git a/source3/pam_smbpass/pam_smb_passwd.c b/source3/pam_smbpass/pam_smb_passwd.c index 91eae3c7a1..9e75efccf4 100644 --- a/source3/pam_smbpass/pam_smb_passwd.c +++ b/source3/pam_smbpass/pam_smb_passwd.c @@ -1,18 +1,22 @@ -/* Unix NT password database implementation, version 0.7.5. - * - * This program is free software; you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) - * any later version. - * - * This program is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for - * more details. - * - * You should have received a copy of the GNU General Public License along with - * this program; if not, write to the Free Software Foundation, Inc., 675 - * Mass Ave, Cambridge, MA 02139, USA. +/* + Unix SMB/CIFS implementation. + Use PAM to update user passwords in the local SAM + Copyright (C) Steve Langasek 1998-2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ /* indicate the following groups are defined */ @@ -20,12 +24,13 @@ #include "includes.h" -#ifndef LINUX +/* This is only used in the Sun implementation. FIXME: we really + want a define here that distinguishes between the Solaris PAM + and others (including FreeBSD). */ -/* This is only used in the Sun implementation. */ +#ifndef LINUX #include <security/pam_appl.h> - -#endif /* LINUX */ +#endif #include <security/pam_modules.h> @@ -35,34 +40,34 @@ int smb_update_db( pam_handle_t *pamh, int ctrl, const char *user, const char *pass_new ) { - int retval; - pstring err_str; - pstring msg_str; - - err_str[0] = '\0'; - msg_str[0] = '\0'; - - retval = local_password_change( user, 0, pass_new, err_str, sizeof(err_str), - msg_str, sizeof(msg_str) ); - - if (!retval) { - if (*err_str) { - err_str[PSTRING_LEN-1] = '\0'; - make_remark( pamh, ctrl, PAM_ERROR_MSG, err_str ); - } - - /* FIXME: what value is appropriate here? */ - retval = PAM_AUTHTOK_ERR; - } else { - if (*msg_str) { - msg_str[PSTRING_LEN-1] = '\0'; - make_remark( pamh, ctrl, PAM_TEXT_INFO, msg_str ); - } - retval = PAM_SUCCESS; - } - - return retval; + int retval; + pstring err_str; + pstring msg_str; + + err_str[0] = '\0'; + msg_str[0] = '\0'; + + retval = local_password_change( user, LOCAL_SET_PASSWORD, pass_new, + err_str, sizeof(err_str), + msg_str, sizeof(msg_str) ); + + if (!retval) { + if (*err_str) { + err_str[PSTRING_LEN-1] = '\0'; + make_remark( pamh, ctrl, PAM_ERROR_MSG, err_str ); + } + + /* FIXME: what value is appropriate here? */ + retval = PAM_AUTHTOK_ERR; + } else { + if (*msg_str) { + msg_str[PSTRING_LEN-1] = '\0'; + make_remark( pamh, ctrl, PAM_TEXT_INFO, msg_str ); + } + retval = PAM_SUCCESS; + } + return retval; } @@ -92,6 +97,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, extern BOOL in_client; SAM_ACCOUNT *sampass = NULL; + void (*oldsig_handler)(int); const char *user; char *pass_old; char *pass_new; @@ -120,18 +126,25 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, _log_err( LOG_DEBUG, "username [%s] obtained", user ); } + /* Getting into places that might use LDAP -- protect the app + from a SIGPIPE it's not expecting */ + oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN); + if (!initialize_password_db(True)) { _log_err( LOG_ALERT, "Cannot access samba password database" ); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_AUTHINFO_UNAVAIL; } /* obtain user record */ if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) { - return nt_status_to_pam(nt_status); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); + return nt_status_to_pam(nt_status); } if (!pdb_getsampwnam(sampass,user)) { _log_err( LOG_ALERT, "Failed to find entry for user %s.", user ); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_USER_UNKNOWN; } @@ -146,6 +159,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, if (_smb_blankpasswd( ctrl, sampass )) { pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_SUCCESS; } @@ -159,6 +173,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, if (Announce == NULL) { _log_err(LOG_CRIT, "password: out of memory"); pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_BUF_ERR; } strncpy( Announce, greeting, sizeof(greeting) ); @@ -174,6 +189,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, _log_err( LOG_NOTICE , "password - (old) token not obtained" ); pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } @@ -188,19 +204,11 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, pass_old = NULL; pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } else if (flags & PAM_UPDATE_AUTHTOK) { -#if 0 - /* We used to return when this flag was set, but that breaks - password synchronization when /other/ tokens are expired. For - now, we change the password whenever we're asked. SRL */ - if (flags & PAM_CHANGE_EXPIRED_AUTHTOK) { - pdb_free_sam(&sampass); - return PAM_SUCCESS; - } -#endif /* * obtain the proposed password */ @@ -226,6 +234,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, if (retval != PAM_SUCCESS) { _log_err( LOG_NOTICE, "password: user not authenticated" ); pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } @@ -253,6 +262,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, } pass_old = NULL; /* tidy up */ pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } @@ -272,6 +282,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, _log_err(LOG_NOTICE, "new password not acceptable"); pass_new = pass_old = NULL; /* tidy up */ pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } @@ -312,6 +323,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, } pdb_free_sam(&sampass); + CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } |